UnityPoint Health Affiliated

The covered entity (CE), UnityPoint Health, discovered that an office manager (from an independent private practice) was using physicians’ passwords to access patients’ protected health information (PHI). The types of PHI involved in the breach included names, social security numbers, addresses, driver’s license numbers, dates of birth, diagnoses, lab results, and medications affecting approximately 1,825 individuals. The CE provided breach notification to HHS, affected individuals, and the media, and contacted the proper authorities to investigate any possible criminal infractions. The CE investigated the breach, which resulted in the office manager’s resignation from her job. The CE also retrained the physicians who shared their passwords with the office manager and obtained written assurances they would no longer share passwords. OCR obtained and reviewed the CE’s HIPAA compliance documentation.